Who we are
PortantisAI is operated in Romania by GOD IS GREAT S.R.L., CUI 52248590, Trade Register J2025057132001, registered office: Strada Brândușelor nr. 10, camera 1, bl. V75A, sc. 3, et. 1, ap. 33, Sector 3, București, Romania ("PortantisAI", "we", or "us"). GOD IS GREAT S.R.L. is the controller for account, security, and service-administration data used to operate PortantisAI.
When we process connected business data solely on behalf of a customer organization, that organization may be the controller and GOD IS GREAT S.R.L. acts as its processor, as applicable. Privacy questions can be sent to [email protected].
Data we process
We receive data directly from you, from your organization administrator, and from services you choose to connect. The exact connected-service data depends on the permissions you approve.
- Closed-beta request data: full name, work email, company website domain, privacy notice version, request time, and expiry date. We do not persist the request IP address.
- Account data: name, work email, organization, role, and authentication or session records.
- Connected-service data: profile name and app-scoped identifiers, authorized business assets, Pages, ad accounts, campaigns, ad sets, ads, creatives, catalogs, product sets, permissions, and performance insights.
- Operational data: settings, actions, recommendations, support messages, and security or audit records needed to operate and protect the service.
- Content you submit: instructions, files, notes, and other information entered into PortantisAI.
How and why we use data
We use data to authenticate users, provide tenant access, connect and synchronize authorized services, display reports, analyze performance, generate recommendations, perform authorized operations, provide support, and protect PortantisAI.
We use closed-beta request data only to review the request and contact you about access. It is not added to a newsletter or used for advertising tracking.
Our legal bases, depending on the context, are performance of a contract, our legitimate interests in operating and securing the service, consent or authorization where required, and compliance with legal obligations.
Shopify store and customer data
When a merchant connects a Shopify store, PortantisAI processes authorized store, product, inventory, order, draft-order, fulfillment, and return data to synchronize commerce operations and provide inventory, purchasing, catalog, customer-support, and financial reports. The available data depends on the store permissions and features the merchant enables.
Order data may include customer names, email addresses, telephone numbers, and billing or delivery addresses. Authorized staff use these details to identify an order, coordinate fulfillment, and handle order or delivery enquiries. Access to a connected store does not grant a Shopify staff member access to a PortantisAI workspace; workspace membership and permissions are required separately.
Merchant-authorized changes may be sent back to Shopify. Operations that use another connected service are subject to that service's configuration and the merchant's authorization. Disconnecting Shopify or uninstalling the app stops access through that connection; it does not itself establish that all previously synchronized records have been deleted.
Merchants and individuals can request access to or deletion of retained Shopify-related personal data at [email protected]. We verify the request and its scope, including requests delivered through Shopify's customer-data and shop-data privacy mechanisms, and apply the retention and deletion rules described in this policy.
Google integrations, AI processing, and Limited Use
Gmail access is limited to the mailbox you authorize. We process its address, relevant message headers and bodies, and correspondence or thread context needed for mailbox verification and your organization's operational email workflows. Standard Gmail authorization requests read and send access; it does not authorize deleting messages, managing Gmail drafts, or changing read labels.
YouTube access lets you select your connected channel, upload a video and its metadata, and read the uploaded video's processing status and visibility. PortantisAI uses this data to provide the publishing operation you request, not for unrelated profiling.
If your organization separately enables an AI-assisted courier workflow, relevant Gmail message text and thread context, together with the operational information needed for that task, may be processed by OpenRouter and eligible hosting providers for OpenAI or Anthropic models. This processing is for the specific user-facing task, not for developing or training generalized AI or machine-learning models. Connecting Gmail alone does not activate these native AI workflows.
Native Gmail-assisted AI requests require provider routing that denies data collection and requires zero-data-retention inference endpoints. An unavailable eligible endpoint must fail the operation rather than remove these restrictions. This routing requirement does not mean that PortantisAI deletes the operational correspondence and audit records needed to provide the service; those records follow the retention and deletion rules below.
PortantisAI's use and transfer of raw or derived Google Workspace data will comply with the Google API Services User Data Policy and Google Workspace API User Data and Developer Policy, including the Limited Use requirements. We do not sell Google user data, use it for advertising, or use or permit its use to train generalized AI or machine-learning models.
Human access to Google user data is limited to the exceptions permitted by Google's policies, such as your specific consent, investigating abuse or security issues, or complying with applicable law. You can disconnect access in PortantisAI, revoke access in your Google Account, and request deletion of previously stored data at [email protected].
Sharing and international transfers
We share data only as needed with authorized users in your organization, connected providers when you request an operation, and contracted service providers that support hosting, databases, security, communications, support, or AI processing. We may also disclose data when required by law or to protect legal rights. We do not sell personal data.
Some providers may process data outside the European Economic Area. Where required, we use an approved transfer mechanism or other lawful safeguard.
Retention, security, and cookies
We keep personal data while an account, tenant, or integration is active and afterward only for as long as reasonably necessary to provide the service, meet legal obligations, resolve disputes, maintain security, and preserve required audit records. The data type, purpose, and applicable legal requirements determine the retention period.
The invitation-only synthetic-data Shopify pilot has a specific operational retention and subprocessor schedule in the Data Processing Agreement at /dpa. It includes monthly review, verified return/deletion handling, restricted evidence retention and backup rotation criteria; it does not authorize real customer-data onboarding or claim automatic erasure of every copy.
Each closed-beta request carries an expiry date 12 months after submission. Expired records are removed through the restricted retention process, and a verified deletion request can remove them earlier.
Disconnecting an integration in PortantisAI clears its stored OAuth tokens, scopes, and token expiry information and stops new access through that connection. Previously synchronized business data or required audit records may remain until they are deleted under the applicable retention process or a valid deletion request.
We use technical and organizational safeguards, including access controls and encryption in transit. No system can guarantee absolute security. PortantisAI uses strictly necessary session and security cookies to sign users in and protect the service; these cookies are not used for advertising.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, or portability of your personal data; object to certain processing; and withdraw consent where processing relies on consent. You may also lodge a complaint with your local data protection authority, including Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP).
Send requests to [email protected]. We may need to verify your identity and your authority to act for an organization before completing a request.
Integrations and policy changes
Connected services, including Meta, process information under their own terms and privacy policies. You control which integrations and permissions you authorize and may revoke provider access through the provider's settings. When PortantisAI exposes a Disconnect action for an installed integration, you may also use it to stop future access.
PortantisAI does not currently make solely automated decisions about individuals that produce legal or similarly significant effects. We may update this policy as the service or law changes and will publish the revised date on this page.